The processes and specialized techniques for gathering, retaining, and analyzing system-related data (digital evidence) for investigative purposes.